You are the CISO at Wonderland county government. The incident response team reports to you that unknown ransomware has successfully attacked the county’s file servers and encrypted production data. As a CISO, which of the following do you think the IR team should conduct next?
A. Identify the root cause and remediate the problem
B. Prioritize the incident
C. Isolate infected machines
D. Validate if the incident is true

Wentz’s Book, The Effective CISSP: Security and Risk Management https://www.amazon.com/dp/B087JL6BXR

Continue reading →

Your company is awarded a contract to develop a customized firewall product for a well-known brand security company. As a security professional, you are a member of the integrated product team. After a workshop for collection and elicitation of protection needs from the customer and stakeholders, you finished specifying security functional and assurance requirements. Which of the following activities conducted by the quality assurance team ensures the product compliant with the specifications? 
A. Certification
B. Accreditation
C. Verification
D. Validation

Wentz’s Book, The Effective CISSP: Security and Risk Management https://www.amazon.com/dp/B087JL6BXR

Continue reading →

Your company develops security products. You are the head of the firewall product line and decide to develop a new firewall model. Formal methods will be used for specification, verification, and other aspects of product development. Which of the following is not a formal method?
A. Fagan inspection
B. Delphi method
C. Lattice-based access control
D. Finite-state machine

Wentz’s Book, The Effective CISSP: Security and Risk Management https://www.amazon.com/dp/B087JL6BXR

Continue reading →

Your company develops security products. You are the head of the firewall product line and decide to develop a new firewall model based on formal designs. Which of the following best supports the design for the product?
A. Use a prescribed system development life cycle (SDLC) compliant with standards
B. Follow the design principle of encapsulation and modulization and best practices
C. Employ a state machine and ensure secure transit between states
D. Gain certification from third-party evaluation for assurance

Wentz’s Book, The Effective CISSP: Security and Risk Management https://www.amazon.com/dp/B087JL6BXR

Continue reading →

Your company is implementing the ERP system. As a security professional, you are selecting security controls as a baseline from a well-known security control framework and customizing it according to your company’s specific requirements and constraints. Which of the following is the least concern during the process of scoping and tailoring?
A. Compensating controls
B. Common controls
C. The impact level of the ERP system
D. Certification and accreditation

Wentz’s Book, The Effective CISSP: Security and Risk Management https://www.amazon.com/dp/B087JL6BXR

Continue reading →

You are implementing a company network for a startup. The IP address of the intranet is 192.168.1.0/24. You split the intranet into two subnets connected by a router: 192.168.1.0/25 and 192.168.128.0/25. Which of the following is the best for the router to forward IP packets from one subnet to the other?
A. Relay agent
B. Routing protocols
C. Routed protocols
D. Static routes

Continue reading →